quasar | 070e3261185784ceb8344c68850dab238d23dfe9935667e28ccc329a21105dfb

Analysis

max time kernel
146s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
30-06-2024 18:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

circinfo (1).exe
Size

3.1MB
MD5

2763babfb8b326e2d65a72df26addb5a
SHA1

a1149202d460f732f18b54169623fd58ba2fc43e
SHA256

070e3261185784ceb8344c68850dab238d23dfe9935667e28ccc329a21105dfb
SHA512

3304f94d612bc71ac592f22be081b861aa7339e979cbf700391f9687d452b4ddfb79de03f78dc280fe7d60cb960457be45da5bc62d5c48405d0450907c3eeb49
SSDEEP

49152:vvRG42pda6D+/PjlLOlg6yQipVNxQEC3pk/JxyoGdgfUTHHB72eh2NT:vvg42pda6D+/PjlLOlZyQipVNxpY

Score

10^/10

quasar motherfucker spyware trojan

Malware Config

Extracted

Family

quasar

Version

1.4.1

Botnet

MotherFucker

registration-suspected.gl.at.ply.gg:60152

127.0.0.1:240

Mutex

7e923a0e-cb03-48fc-87a3-d5d222b55fa8

Attributes

encryption_key
43F51C3DD1637A1DF460F58619C015C31CCF137E
install_name
Client.exe
log_directory
Logs
reconnect_delay
3000
startup_key
Quasar Client Startup
subdirectory
SubDir

Signatures

Quasar RAT
Quasar is an open source Remote Access Tool.
trojan spyware quasar
Quasar payload 1 IoCs

Processes:

resource yara_rule

behavioral2/memory/1844-1-0x0000000000250000-0x0000000000574000-memory.dmp family_quasar
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

1032 PING.EXE
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

circinfo (1).exe

description pid process

Token: SeDebugPrivilege 1844 circinfo (1).exe

resource	yara_rule
behavioral2/memory/1844-1-0x0000000000250000-0x0000000000574000-memory.dmp	family_quasar

pid	process
1032	PING.EXE

description	pid	process
Token: SeDebugPrivilege	1844	circinfo (1).exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

circinfo (1).execmd.exe

description	pid	process	target process
PID 1844 wrote to memory of 4872	1844	circinfo (1).exe	cmd.exe
PID 1844 wrote to memory of 4872	1844	circinfo (1).exe	cmd.exe
PID 4872 wrote to memory of 1808	4872	cmd.exe	chcp.com
PID 4872 wrote to memory of 1808	4872	cmd.exe	chcp.com
PID 4872 wrote to memory of 1032	4872	cmd.exe	PING.EXE
PID 4872 wrote to memory of 1032	4872	cmd.exe	PING.EXE

C:\Users\Admin\AppData\Local\Temp\circinfo (1).exe
"C:\Users\Admin\AppData\Local\Temp\circinfo (1).exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1844

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\MDJCpeJ49VjT.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:4872

C:\Windows\system32\chcp.com
chcp 65001
3⤵
PID:1808

C:\Windows\system32\PING.EXE
ping -n 10 localhost
3⤵
- Runs ping.exe
PID:1032

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Remote System Discovery

T1018

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\MDJCpeJ49VjT.bat
Filesize
213B

MD5
59e1bc621da4bc301d49ee3d661c4bd4

SHA1
aef1b43e9e9ef9c3fe7ee6f8adf40e8bd4f33bc0

SHA256
335e3d5c21c07e27e261aa0730560081e222cb05d603e1b223c19d0788c58bc1

SHA512
eaf241713558de3fb55eaba533961781a5d1805b4b4b1760dfbe511be1e458be0d9ff7689cc01aa7922ee2dc01ebcb87f4163e5264517dad8b92d7fc8f18d034

Download Submit
memory/1844-0-0x00007FF994853000-0x00007FF994855000-memory.dmp

Filesize
8KB

Download
memory/1844-1-0x0000000000250000-0x0000000000574000-memory.dmp

Filesize
3.1MB

Download
memory/1844-2-0x00007FF994850000-0x00007FF995312000-memory.dmp

Filesize
10.8MB

Download
memory/1844-3-0x000000001B9A0000-0x000000001B9F0000-memory.dmp

Filesize
320KB

Download
memory/1844-4-0x000000001BAB0000-0x000000001BB62000-memory.dmp

Filesize
712KB

Download
memory/1844-7-0x000000001B9F0000-0x000000001BA02000-memory.dmp

Filesize
72KB

Download
memory/1844-8-0x000000001BA50000-0x000000001BA8C000-memory.dmp

Filesize
240KB

Download
memory/1844-9-0x00007FF994853000-0x00007FF994855000-memory.dmp

Filesize
8KB

Download
memory/1844-10-0x00007FF994850000-0x00007FF995312000-memory.dmp

Filesize
10.8MB

Download
memory/1844-15-0x00007FF994850000-0x00007FF995312000-memory.dmp

Filesize
10.8MB

Download